

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=auto>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/fluid.png">
  <link rel="icon" href="/img/fluid.png">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="author" content="Jiashi">
  <meta name="keywords" content="">
  
    <meta name="description" content="恶意代码的编写者开发了多种技术，来实现隐蔽的恶意代码启动。">
<meta property="og:type" content="article">
<meta property="og:title" content="恶意代码注入">
<meta property="og:url" content="https://jiashi19.gitee.io/2024/02/04/%E6%81%B6%E6%84%8F%E4%BB%A3%E7%A0%81%E6%B3%A8%E5%85%A5/index.html">
<meta property="og:site_name" content="Blog from js19">
<meta property="og:description" content="恶意代码的编写者开发了多种技术，来实现隐蔽的恶意代码启动。">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://s2.loli.net/2023/12/04/mKHxbGeXOq37k1W.png">
<meta property="og:image" content="https://s2.loli.net/2023/12/04/4cBzg3HdPprayLe.png">
<meta property="og:image" content="https://s2.loli.net/2023/12/04/ivHNmlhocYGOgMR.png">
<meta property="og:image" content="https://s2.loli.net/2023/12/04/lu7PxUp6m2cVzO3.png">
<meta property="article:published_time" content="2024-02-04T08:52:38.000Z">
<meta property="article:modified_time" content="2024-02-04T08:59:27.682Z">
<meta property="article:author" content="Jiashi">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:image" content="https://s2.loli.net/2023/12/04/mKHxbGeXOq37k1W.png">
  
  
    <meta name="referrer" content="no-referrer-when-downgrade">
  
  
  <title>恶意代码注入 - Blog from js19</title>

  <link  rel="stylesheet" href="https://lib.baomitu.com/twitter-bootstrap/4.6.1/css/bootstrap.min.css" />



  <link  rel="stylesheet" href="https://lib.baomitu.com/github-markdown-css/4.0.0/github-markdown.min.css" />

  <link  rel="stylesheet" href="https://lib.baomitu.com/hint.css/2.7.0/hint.min.css" />

  <link  rel="stylesheet" href="https://lib.baomitu.com/fancybox/3.5.7/jquery.fancybox.min.css" />



<!-- 主题依赖的图标库，不要自行修改 -->
<!-- Do not modify the link that theme dependent icons -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_hj8rtnfg7um.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_lbnruvf0jn.css">


<link  rel="stylesheet" href="/css/main.css" />


  <link id="highlight-css" rel="stylesheet" href="/css/highlight.css" />
  
    <link id="highlight-css-dark" rel="stylesheet" href="/css/highlight-dark.css" />
  




  <script id="fluid-configs">
    var Fluid = window.Fluid || {};
    Fluid.ctx = Object.assign({}, Fluid.ctx)
    var CONFIG = {"hostname":"jiashi19.gitee.io","root":"/","version":"1.9.5-a","typing":{"enable":true,"typeSpeed":70,"cursorChar":"_","loop":false,"scope":[]},"anchorjs":{"enable":true,"element":"h1,h2,h3,h4,h5,h6","placement":"left","visible":"hover","icon":""},"progressbar":{"enable":true,"height_px":3,"color":"#29d","options":{"showSpinner":false,"trickleSpeed":100}},"code_language":{"enable":true,"default":"TEXT"},"copy_btn":true,"image_caption":{"enable":true},"image_zoom":{"enable":true,"img_url_replace":["",""]},"toc":{"enable":true,"placement":"right","headingSelector":"h1,h2,h3,h4,h5,h6","collapseDepth":0},"lazyload":{"enable":true,"loading_img":"/img/loading.gif","onlypost":false,"offset_factor":2},"web_analytics":{"enable":false,"follow_dnt":true,"baidu":null,"google":{"measurement_id":null},"tencent":{"sid":null,"cid":null},"woyaola":null,"cnzz":null,"leancloud":{"app_id":null,"app_key":null,"server_url":null,"path":"window.location.pathname","ignore_local":false}},"search_path":"/local-search.xml","include_content_in_search":true};

    if (CONFIG.web_analytics.follow_dnt) {
      var dntVal = navigator.doNotTrack || window.doNotTrack || navigator.msDoNotTrack;
      Fluid.ctx.dnt = dntVal && (dntVal.startsWith('1') || dntVal.startsWith('yes') || dntVal.startsWith('on'));
    }
  </script>
  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
  


  
<meta name="generator" content="Hexo 6.3.0"></head>


<body>
  

  <header>
    

<div class="header-inner" style="height: 70vh;">
  <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand" href="/">
      <strong>jiashi&#39;s blog</strong>
    </a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                <span>首页</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                <span>归档</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                <span>分类</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                <span>标签</span>
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                <span>关于</span>
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" target="_self" href="javascript:;" data-toggle="modal" data-target="#modalSearch" aria-label="Search">
              <i class="iconfont icon-search"></i>
            </a>
          </li>
          
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" target="_self" href="javascript:;" aria-label="Color Toggle">
              <i class="iconfont icon-dark" id="color-toggle-icon"></i>
            </a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

  

<div id="banner" class="banner" parallax=true
     style="background: url('/img/default.png') no-repeat center center; background-size: cover;">
  <div class="full-bg-img">
    <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
      <div class="banner-text text-center fade-in-up">
        <div class="h2">
          
            <span id="subtitle" data-typed-text="恶意代码注入"></span>
          
        </div>

        
          
  <div class="mt-3">
    
    
      <span class="post-meta">
        <i class="iconfont icon-date-fill" aria-hidden="true"></i>
        <time datetime="2024-02-04 16:52" pubdate>
          2024年2月4日 下午
        </time>
      </span>
    
  </div>

  <div class="mt-1">
    
      <span class="post-meta mr-2">
        <i class="iconfont icon-chart"></i>
        
          4.6k 字
        
      </span>
    

    
      <span class="post-meta mr-2">
        <i class="iconfont icon-clock-fill"></i>
        
        
        
          39 分钟
        
      </span>
    

    
    
  </div>


        
      </div>

      
    </div>
  </div>
</div>

</div>

  </header>

  <main>
    
      

<div class="container-fluid nopadding-x">
  <div class="row nomargin-x">
    <div class="side-col d-none d-lg-block col-lg-2">
      

    </div>

    <div class="col-lg-8 nopadding-x-md">
      <div class="container nopadding-x-md" id="board-ctn">
        <div id="board">
          <article class="post-content mx-auto">
            <h1 id="seo-header">恶意代码注入</h1>
            
            
              <div class="markdown-body">
                
                <p>恶意代码的编写者开发了多种技术，来实现隐蔽的恶意代码启动。</p>
<span id="more"></span>

<h2 id="启动器-Launcher"><a href="#启动器-Launcher" class="headerlink" title="启动器(Launcher)"></a>启动器(Launcher)</h2><ul>
<li>定义：也称为加载器，用来启动其他恶意程序的恶意代码。通常情况下，启动器使用一些非传统的技术，来启动其他恶意程序。</li>
<li>目的：使恶意行为对用户隐藏；可能包含<strong>提权</strong>代码，以更高权限访问系统。</li>
<li>启动器经常包含它要加载的恶意代码。最常见的情况是在它的资源节中包含一个可执行文件或DLL。</li>
<li>常用资源操作API函数： <code>FindResource </code>，<code>LoadResource</code> ，<code> SizeofResource</code> 。</li>
</ul>
<h2 id="进程注入"><a href="#进程注入" class="headerlink" title="进程注入"></a>进程注入</h2><ul>
<li><p>定义：这种技术是将代码注入到<strong>另外一个正在运行</strong>的进程中，而被注入的进程会不知不觉地运行注入的代码。</p>
</li>
<li><p>常用函数：</p>
<p>VirtualAllocEx：在指定进程中分配一块内存空间。</p>
<p>WriteProcessMemory：此函数能向VirtualAllocEx函数分配的地址空间写数据。</p>
</li>
</ul>
<p>在实现过程中，需要先获取目标进程的ID。**OpenProcess( )**这个API实现打开进程（返回进程的句柄）。</p>
<h3 id="DLL注入"><a href="#DLL注入" class="headerlink" title="DLL注入"></a>DLL注入</h3><p><strong>定义</strong>：</p>
<ul>
<li>DLL注入是进程注入的一种形式，它强迫一个远程进程加载恶意DLL程序，同时它是最常用的秘密加载技术。</li>
<li>所谓DLL注入就是将一个DLL放进某个进程的地址空间里，让它成为那个进程的一部分。</li>
</ul>
<p><strong>基本思路</strong>：</p>
<p>调用 <strong>CreateRemoteThread</strong> ( 三个重要参数：进程句柄、注入线程入口点、线程参数)时，线程入口点设置为LoadLibrary函数的地址，并且恶意DLL名字作为它的参数。</p>
<p><img src="https://s2.loli.net/2023/12/04/mKHxbGeXOq37k1W.png" srcset="/img/loading.gif" lazyload alt="image-20231204085749284"></p>
<p><strong>实现过程：</strong></p>
<ul>
<li>FindWindow( )、GetWindowThreadProcessId( )&#x2F; CreateToolhelp32Snapshot( )，Process32First( )和Process32Next( )这两组函数就是为了获得目标进程的ID，**OpenProcess( )**这个API实现打开进程。</li>
<li>VirtualAllocEx( )向“宿主进程”申请内存。</li>
<li>WriteProcessMemory( )把特定的数据（恶意DLL模块或恶意代码）写进“目标进程”。 </li>
<li>GetProcAddress( )检索指定的动态链接库(DLL)中的输出库函数（LoadLibrary）地址。</li>
<li>LoadLibrary( )是加载DLL文件的必备API。</li>
<li>CreateRemoteThread( )或者NtCreateThreadEx ( )或RtlCreateUserThread ( ) ，这个API强制在宿主进程里面新建一个线程。</li>
<li>WaitForSingleObject( )、VirtualFreeEx( )、CloseHandle( )等待与清理。</li>
</ul>
<p><img src="https://s2.loli.net/2023/12/04/4cBzg3HdPprayLe.png" srcset="/img/loading.gif" lazyload alt="image-20231204090132584"></p>
<p>参考教程：<a target="_blank" rel="noopener" href="https://www.cnblogs.com/Xy--1/p/14506866.html">DLL进程注入之CreateRemoteThread() - Lushun - 博客园 (cnblogs.com)</a></p>
<h3 id="直接注入"><a href="#直接注入" class="headerlink" title="直接注入"></a>直接注入</h3><p><strong>相同点：</strong></p>
<p>同DLL注入一样，在远程进程的内存空间中分配和插入代码，使用类似的Windows函数。</p>
<p><strong>不同点：</strong></p>
<p>不单独编写DLL，直接将恶意代码注入到远程进程中，比DLL注入更加灵活。</p>
<p><strong>特点：</strong></p>
<ul>
<li>需要大量的定制代码。</li>
<li>通常用来注入shellcode。</li>
<li>两次VirtualAllocEx()和WriteProcessMemory()：第一次分配内容空间并写入数据；第二次分配内存空间并写入代码。</li>
<li>要求精通汇编语言，或编写简单的shellcode。</li>
</ul>
<p>参考教程：<a target="_blank" rel="noopener" href="https://xz.aliyun.com/t/11933">进程注入：通过远程线程注入代码 - 先知社区 (aliyun.com)</a></p>
<h2 id="进程替换"><a href="#进程替换" class="headerlink" title="进程替换"></a>进程替换</h2><p><strong>定义：</strong></p>
<p>进程替换是指将正在运行的程序的内存空间用恶意代码替换掉。如果被替换的进程是合法的进程, 那么恶</p>
<p>意代码可以披着合法的外衣干坏事。</p>
<p><strong>关键点：</strong></p>
<p>以挂起状态创建一个进程。 CreateProcess以CREATE_SUSPENDED方式调用。</p>
<p><strong>进程替换过程：</strong></p>
<ul>
<li>创建一个挂起状态的进程, 此时进程的主线程还未开始运行；</li>
<li>读取主线程的上下文, 并读取新创建进程的基址；</li>
<li>使用ZwUnmapViewOfSection&#x2F;NtUnmapViewOfSection将新创建的进程的内存空间释放掉, 随后可以开始填充恶意代码；</li>
<li>用VirtualAllocEx在子进程指定的基址分配空间，调用ReadProcessMemoryWriteProcessMemory来读写子进程空间的内容，调用VirtualProtectEx修改内存的属性为可读可写可执行；</li>
<li>设置主线程的上下文, 启动主线程。</li>
</ul>
<p><strong>伪代码：</strong></p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs c">CreateProcess(cAppName, ....., CREATE_SUSPENDED, .....);<span class="hljs-comment">//创建挂起进程</span><br><br>ZwUnmapViewOfSection（....）; <span class="hljs-comment">//释放内存</span><br><br>VirtualAllocEx(...,ImageBase,SizeOfImge....); <span class="hljs-comment">//为恶意代码分配新的内存</span><br><br>WriteProcessMemory（...headers,...）; <span class="hljs-comment">//将恶意代码每个段写入进程空间</span><br><br><span class="hljs-keyword">for</span> &#123;WriteProcessMemory ();&#125;<br><br>SetThreadContext(); <span class="hljs-comment">//入口点指向恶意代码</span><br><br>....<br><br>ResumeThread(); <span class="hljs-comment">//执行</span><br></code></pre></td></tr></table></figure>

<h2 id="钩子-Hook-注入"><a href="#钩子-Hook-注入" class="headerlink" title="钩子(Hook)注入"></a>钩子(Hook)注入</h2><p>钩子(Hook)，是Windows消息处理机制的一个平台，应用程序可以在上面设置子程以监视指定窗口的某种消息，而且所监视的窗口可以是其他进程所创建的。当消息到达后，在目标窗口处理函数之前处理它。钩子机制允许应用程序截获处理Window消息或特定事件。</p>
<p>钩子实际上是一个处理消息的程序段，通过系统调用，把它挂入系统。每当特定的消息发出，在没有到达目的窗口前，钩子程序就先捕获该消息，亦即钩子函数先得到控制权。这时钩子函数即可以加工处理（改变）该消息，也可以不作处理而继续传递该消息，还可以强制结束消息的传递。</p>
<p>没有使用钩子注入和使用钩子注入的Windows事件和消息流：</p>
<img src="https://s2.loli.net/2023/12/04/ivHNmlhocYGOgMR.png" srcset="/img/loading.gif" lazyload alt="image-20231204091626450" style="zoom:67%;" />

<h3 id="钩子的分类"><a href="#钩子的分类" class="headerlink" title="钩子的分类"></a>钩子的分类</h3><p><strong>按使用范围分类：</strong></p>
<ul>
<li><p>系统钩子（全局钩子）</p>
<ul>
<li>监视系统中的所有线程的事件消息。</li>
<li>会影响系统中所有应用程序，钩子函数必须放在<strong>独立的DLL</strong>中。</li>
<li>系统自动将包含“钩子回调函数”的DLL映射到受钩子函数影响的所有进程的地址空间中，即将这个DLL注入到那些进程。</li>
</ul>
</li>
<li><p>线程钩子（局部钩子）</p>
<ul>
<li>用于监视指定线程的事件消息。</li>
<li>一般在当前线程或者当前线程派生的线程内。</li>
</ul>
</li>
</ul>
<p><strong>按事件分类：</strong></p>
<ul>
<li>键盘钩子和低级键盘钩子可以监视各种键盘消息。</li>
<li>鼠标钩子和低级鼠标钩子可以监视各种鼠标消息。</li>
<li>shell钩子可以监视各种Shell事件消息。比如：启动和关闭应用程序。</li>
<li>日志钩子可以记录从系统消息队列中取出的各种事件消息。</li>
<li>窗口过程钩子监视所有从系统消息队列发往目标窗口的消息。</li>
<li>还有一些特定事件的钩子。</li>
</ul>
<h3 id="系统钩子和线程钩子"><a href="#系统钩子和线程钩子" class="headerlink" title="系统钩子和线程钩子"></a>系统钩子和线程钩子</h3><ul>
<li>SetWindowsHookEx()函数的<strong>最后一个参数，决定此钩子是系统钩子还是线程钩子。</strong></li>
<li>如果对同一事件（如鼠标消息）既安装线程钩子又安装系统钩子，那么系统会自动先调用线程钩子，然后调用系统钩子。</li>
<li>对同一事件消息可安装多个钩子处理过程，这些钩子处理过程形成钩子链。当前钩子处理结束后，应把钩子信息传递给下一个钩子函数。</li>
<li>钩子特别是系统钩子会消耗消息处理时间，降低系统性能。只有在必要的时候才安装钩子，在使用完毕后要及时卸载。</li>
</ul>
<h3 id="使用钩子的键盘记录器"><a href="#使用钩子的键盘记录器" class="headerlink" title="使用钩子的键盘记录器"></a>使用钩子的键盘记录器</h3><img src="https://s2.loli.net/2023/12/04/lu7PxUp6m2cVzO3.png" srcset="/img/loading.gif" lazyload alt="image-20231204092837469" style="zoom:50%;" />

<h3 id="使用SetWindowsHookEx"><a href="#使用SetWindowsHookEx" class="headerlink" title="使用SetWindowsHookEx"></a>使用SetWindowsHookEx</h3><p><strong>功能：</strong>该函数将一个应用程序定义的挂钩处理过程<strong>安装到挂钩链</strong>中，可以通过安装挂钩处理过程来对系统的某些类型事件进行监控，这些事件与某个特定的线程或系统中的所有事件相关。</p>
<p><strong>函数原型：</strong></p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><code class="hljs c">HHOOK WINAPI <span class="hljs-title function_">SetWindowsHookEx</span><span class="hljs-params">(</span><br><span class="hljs-params"></span><br><span class="hljs-params">__in <span class="hljs-type">int</span> idHook, \\钩子类型</span><br><span class="hljs-params"></span><br><span class="hljs-params">__in HOOKPROC lpfn, \\回调函数地址</span><br><span class="hljs-params"></span><br><span class="hljs-params">__in HINSTANCE hMod, \\实例句柄</span><br><span class="hljs-params"></span><br><span class="hljs-params">__in DWORD dwThreadId \\线程ID</span><br><span class="hljs-params"></span><br><span class="hljs-params">)</span>;<br><br>LRESULT WINAPI <span class="hljs-title function_">CallNextHookEx</span><span class="hljs-params">(</span><br><span class="hljs-params"></span><br><span class="hljs-params">_In_opt_ HHOOK hhk， \\ 保存的钩子过程,也就是SetWindowsHookEx返回值.</span><br><span class="hljs-params"></span><br><span class="hljs-params">_In_ <span class="hljs-type">int</span> nCode， \\ 根据SetWindowsHookEx设置的钩子回调而产生的不同的nCode代码.</span><br><span class="hljs-params"></span><br><span class="hljs-params">\\如果设置的钩子类型是鼠标消息.那么那个nCode就是鼠标消息.如果是键盘这是键盘</span><br><span class="hljs-params"></span><br><span class="hljs-params">_In_ WPARAM wParam， \\ 同<span class="hljs-number">2</span>参数一样.附加参数. 根据钩子回调类型.附加参</span><br><span class="hljs-params"></span><br><span class="hljs-params">数有不同的意义.</span><br><span class="hljs-params"></span><br><span class="hljs-params">_In_ LPARAM lParam \\ 同<span class="hljs-number">3</span>参数一样.附加参数.</span><br><span class="hljs-params"></span><br><span class="hljs-params">)</span>;<br></code></pre></td></tr></table></figure>

<p><strong>参数</strong>：<br>idHook：指示欲被安装的挂钩处理过程的类型。（14种）<br>lpfn：指向相应的<strong>挂钩处理过程</strong>。若参数dwThreadId为0或者指示一个其他进程创建的线程的标识符，则参数lpfn必须指向一个DLL中的挂钩处理过程。否则，参数lpfn可以指向一个与当前进程相关的代码中定义的挂钩处理过程。<br>hMod：指示一个DLL的句柄，该DLL包含参数lpfn所指向的挂钩处理过程。若参数dwThreadId指示的线程由当前进程创建，并且相应的挂钩处理过程定义于当前进程相关的代码中，则参数hMod必须被设置为NULL(0)。<br><strong>dwThreadId：指示一个线程标识符，挂钩处理过程与线程相关（线程钩子）。若此参数值为0，则该挂钩处理过程与所有现存的线程相关。（系统钩子）</strong></p>
<p><strong>钩子的示例</strong>：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs c">HHOOK keyboardHook, hhook;<br>LRESULT CALLBACK <span class="hljs-title function_">KeyboardProc</span><span class="hljs-params">( _In_int code,  _In_WPARAM wParam,  _In_LPARAM lParam)</span><br>&#123;	<br>       ::MessageBox(<span class="hljs-literal">NULL</span>, “按键了”, “caption”, <span class="hljs-number">0x00000002</span>L);	<br>       <span class="hljs-keyword">return</span> CallNextHookEx(keyboardHook, code, wParam, lParam);    <span class="hljs-comment">//第一个参数一般可以为NULL</span><br>&#125;<br><br> <span class="hljs-comment">//在对应线程设置键盘钩子</span><br><span class="hljs-type">void</span> <span class="hljs-title function_">setHook</span><span class="hljs-params">(DWORD threadId)</span>	<span class="hljs-comment">//需要Hook的线程ID</span><br>&#123;	<br>          <span class="hljs-comment">//Hook其他进程中的线程，设置KeyboardProc回调函数，该函数在“mydll.dll”中实现</span><br>          keyboardHook=SetWindowsHookEx(WH_KEYBOARDPROC, KeyboardProc, GetModuleHandle(“mydll.dll”), threadId);<br>         <span class="hljs-comment">//Hook自身进程中的线程	</span><br>          hhook =SetWindowsHookEx(WH_KEYBOARDPROC, KeyboardProc, <span class="hljs-literal">NULL</span>, threadId);<br>&#125;<br></code></pre></td></tr></table></figure>

<p>参考链接：<a target="_blank" rel="noopener" href="https://cloud.tencent.com/developer/article/1199648">https://cloud.tencent.com/developer/article/1199648</a></p>
<h2 id="Detours"><a href="#Detours" class="headerlink" title="Detours"></a>Detours</h2><ul>
<li>Detours是一个在x86、x64、IA64和ARM64平台上截获任意API函数调用的工具库。</li>
<li>Detours使用一个无条件转移指令来替换目标函数的最初几条指令，将控制流转移到一个用户提供的截获函数。</li>
<li>目标函数中的一些指令被保存在一个被称为“trampoline”的函数中。</li>
<li>这些指令包括目标函数中被替换的代码，以及一个重新跳转到目标函数的无条件分支。而截获函数可以替换目标函数，或者通过执行“trampoline”函数的时候，将目标函数作为子程序来调用的办法来扩展功能。</li>
</ul>

                
              </div>
            
            <hr/>
            <div>
              <div class="post-metas my-3">
  
    <div class="post-meta mr-3 d-flex align-items-center">
      <i class="iconfont icon-category"></i>
      

<span class="category-chains">
  
  
    
      <span class="category-chain">
        
  <a href="/categories/%E6%81%B6%E6%84%8F%E4%BB%A3%E7%A0%81%E5%88%86%E6%9E%90/" class="category-chain-item">恶意代码分析</a>
  
  

      </span>
    
  
</span>

    </div>
  
  
</div>


              
  

  <div class="license-box my-3">
    <div class="license-title">
      <div>恶意代码注入</div>
      <div>https://jiashi19.gitee.io/2024/02/04/恶意代码注入/</div>
    </div>
    <div class="license-meta">
      
        <div class="license-meta-item">
          <div>作者</div>
          <div>Jiashi</div>
        </div>
      
      
        <div class="license-meta-item license-meta-date">
          <div>发布于</div>
          <div>2024年2月4日</div>
        </div>
      
      
      
        <div class="license-meta-item">
          <div>许可协议</div>
          <div>
            
              
              
                <a class="print-no-link" target="_blank" href="https://creativecommons.org/licenses/by/4.0/">
                  <span class="hint--top hint--rounded" aria-label="BY - 署名">
                    <i class="iconfont icon-by"></i>
                  </span>
                </a>
              
            
          </div>
        </div>
      
    </div>
    <div class="license-icon iconfont"></div>
  </div>



              
                <div class="post-prevnext my-3">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2024/02/11/ssrf/" title="SSRF">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">SSRF</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2024/02/04/%E6%81%B6%E6%84%8Fwindows%E7%A8%8B%E5%BA%8F/" title="恶意windows程序">
                        <span class="hidden-mobile">恶意windows程序</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
          </article>
        </div>
      </div>
    </div>

    <div class="side-col d-none d-lg-block col-lg-2">
      
  <aside class="sidebar" style="margin-left: -1rem">
    <div id="toc">
  <p class="toc-header">
    <i class="iconfont icon-list"></i>
    <span>目录</span>
  </p>
  <div class="toc-body" id="toc-body"></div>
</div>



  </aside>


    </div>
  </div>
</div>





  



  



  



  



  







    

    
      <a id="scroll-top-button" aria-label="TOP" href="#" role="button">
        <i class="iconfont icon-arrowup" aria-hidden="true"></i>
      </a>
    

    
      <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v" for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>

    

    
  </main>

  <footer>
    <div class="footer-inner">
  
    <div class="footer-content">
       <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>Hexo</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
    </div>
  
  
    <div class="statistics">
  
  

  
    
      <span id="busuanzi_container_site_pv" style="display: none">
        总访问量 
        <span id="busuanzi_value_site_pv"></span>
         次
      </span>
    
    
      <span id="busuanzi_container_site_uv" style="display: none">
        总访客数 
        <span id="busuanzi_value_site_uv"></span>
         人
      </span>
    
    
  
</div>

  
  
  
</div>

  </footer>

  <!-- Scripts -->
  
  <script  src="https://lib.baomitu.com/nprogress/0.2.0/nprogress.min.js" ></script>
  <link  rel="stylesheet" href="https://lib.baomitu.com/nprogress/0.2.0/nprogress.min.css" />

  <script>
    NProgress.configure({"showSpinner":false,"trickleSpeed":100})
    NProgress.start()
    window.addEventListener('load', function() {
      NProgress.done();
    })
  </script>


<script  src="https://lib.baomitu.com/jquery/3.6.4/jquery.min.js" ></script>
<script  src="https://lib.baomitu.com/twitter-bootstrap/4.6.1/js/bootstrap.min.js" ></script>
<script  src="/js/events.js" ></script>
<script  src="/js/plugins.js" ></script>


  <script  src="https://lib.baomitu.com/typed.js/2.0.12/typed.min.js" ></script>
  <script>
    (function (window, document) {
      var typing = Fluid.plugins.typing;
      var subtitle = document.getElementById('subtitle');
      if (!subtitle || !typing) {
        return;
      }
      var text = subtitle.getAttribute('data-typed-text');
      
        typing(text);
      
    })(window, document);
  </script>




  
    <script  src="/js/img-lazyload.js" ></script>
  




  
<script>
  Fluid.utils.createScript('https://lib.baomitu.com/tocbot/4.20.1/tocbot.min.js', function() {
    var toc = jQuery('#toc');
    if (toc.length === 0 || !window.tocbot) { return; }
    var boardCtn = jQuery('#board-ctn');
    var boardTop = boardCtn.offset().top;

    window.tocbot.init(Object.assign({
      tocSelector     : '#toc-body',
      contentSelector : '.markdown-body',
      linkClass       : 'tocbot-link',
      activeLinkClass : 'tocbot-active-link',
      listClass       : 'tocbot-list',
      isCollapsedClass: 'tocbot-is-collapsed',
      collapsibleClass: 'tocbot-is-collapsible',
      scrollSmooth    : true,
      includeTitleTags: true,
      headingsOffset  : -boardTop,
    }, CONFIG.toc));
    if (toc.find('.toc-list-item').length > 0) {
      toc.css('visibility', 'visible');
    }

    Fluid.events.registerRefreshCallback(function() {
      if ('tocbot' in window) {
        tocbot.refresh();
        var toc = jQuery('#toc');
        if (toc.length === 0 || !tocbot) {
          return;
        }
        if (toc.find('.toc-list-item').length > 0) {
          toc.css('visibility', 'visible');
        }
      }
    });
  });
</script>


  <script src=https://lib.baomitu.com/clipboard.js/2.0.11/clipboard.min.js></script>

  <script>Fluid.plugins.codeWidget();</script>


  
<script>
  Fluid.utils.createScript('https://lib.baomitu.com/anchor-js/4.3.1/anchor.min.js', function() {
    window.anchors.options = {
      placement: CONFIG.anchorjs.placement,
      visible  : CONFIG.anchorjs.visible
    };
    if (CONFIG.anchorjs.icon) {
      window.anchors.options.icon = CONFIG.anchorjs.icon;
    }
    var el = (CONFIG.anchorjs.element || 'h1,h2,h3,h4,h5,h6').split(',');
    var res = [];
    for (var item of el) {
      res.push('.markdown-body > ' + item.trim());
    }
    if (CONFIG.anchorjs.placement === 'left') {
      window.anchors.options.class = 'anchorjs-link-left';
    }
    window.anchors.add(res.join(', '));

    Fluid.events.registerRefreshCallback(function() {
      if ('anchors' in window) {
        anchors.removeAll();
        var el = (CONFIG.anchorjs.element || 'h1,h2,h3,h4,h5,h6').split(',');
        var res = [];
        for (var item of el) {
          res.push('.markdown-body > ' + item.trim());
        }
        if (CONFIG.anchorjs.placement === 'left') {
          anchors.options.class = 'anchorjs-link-left';
        }
        anchors.add(res.join(', '));
      }
    });
  });
</script>


  
<script>
  Fluid.utils.createScript('https://lib.baomitu.com/fancybox/3.5.7/jquery.fancybox.min.js', function() {
    Fluid.plugins.fancyBox();
  });
</script>


  <script>Fluid.plugins.imageCaption();</script>

  <script  src="/js/local-search.js" ></script>

  <script defer src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>





<!-- 主题的启动项，将它保持在最底部 -->
<!-- the boot of the theme, keep it at the bottom -->
<script  src="/js/boot.js" ></script>


  

  <noscript>
    <div class="noscript-warning">博客在允许 JavaScript 运行的环境下浏览效果更佳</div>
  </noscript>
</body>
</html>
